Can paypal vendors verify card used and/or spending history?

Question

So I recently made a purchase from https://us.roborock.com, a well known manufacturer. During the checkout process, I used PayPal.
However several hours after checkout was complete, I received an email with the following content from the vendor:

I am sorry to tell you that our system reminds us your order is medium risk as the shipping address is 742 km from location of IP address, could you please tell us the reason?

To help us confirm your are the card owner,

1. could you please provide us part of your credit card spending history from 3 months ago?
2. would you mind sending us a picture of your ID card and shows your name?

This raises several red flags, and doesn't make sense. I made the purchase through PayPal, how would this vendor know I used a credit card? I did, but does PayPal disclose this? And how would this vendor have my purchase history to be able to verify from my activity 3 months ago?

I already said "no", and to cancel the order as there's no way I'm providing that information. In normal situations, this would be screaming "fraud" to me. However as mentioned, this is a well known company. So I'm just confused.

Answer 1

It's unreasonable. Suppose a large company buys stuff at headquarters for their sites, maybe even the manager located at the site purchases but he's connected to a VPN to headquarters and easily you're right in this situation.

Regarding ip address location accuracy, have a look at MaxMind GeoIP2 accuracy. Especially on a cellular network, the location accuracy is shockingly low. It's fine for guessing the country, but how about guessing location inside the country? For a 250km circle around you in the US on a cellular network the accuracy is only at 57%, meaning in almost every second guess the actual location is more than 250km from the guessed location.

Now you're paying with PayPal, meaning the vendor decided to offload payment processing and risk-management. The PayPal fees already cover PayPal's risk of non-payment. It's simply not Roborock's responsibility to double check. All they have to do is deliver to the noted shipping address and they get paid by PayPal.

Obviously Roborock may still restrict the delivery area at checkout, e.g. when they don't like shipping overseas. But that does not seem to be the case here.

From personal experience with PayPal I'd say mentioning credit card is just an educated guess, simply because most people in the US use such cards for digital payments. PayPal itself provides buyer name, email address & selected shipping location only.

Finally for a medium-risk case, that's an extremely large and extremely sensitive amount of data they requested. I would have rejected as well.